The feature protects the app from exploits and doesn't provide any additional security for the OS from the app. It's worth noting most users are having no issues running OsmAnd with hardened_malloc.
As the post calls out, most certificate authorities will not issue certs against .arpa domains. I found this out the hard way when paying for CloudFlare's Advanced Certificates add-on for an .arpa domain I had successfully delegated and registered.
They return failures and exceptions when attempting to generate the certificate for the .arpa domain and then I spent months trying to get a refund (they are very slow to respond) and only caved once I threatened a chargeback for the service not working as advertised.
